1.4 Compare Security Concepts 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A risk assessment team is documenting the steps they followed. They started by listing all critical assets, then identified potential threats such as malware and insider threats, and then analyzed the vulnerabilities in each asset. What is the next step in the risk assessment process?

   • ARisk evaluation, where they determine the likelihood and impact of each threat exploiting a vulnerability.
   • BRisk treatment, where they decide how to mitigate the identified risks.
   • CAsset identification, where they list all critical assets.
   • DThreat modeling, where they create a detailed profile of each threat actor.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A financial services company has identified a critical vulnerability in its customer-facing web application. The vulnerability could allow an attacker to access customer financial data. The company has the following constraints: (1) the application cannot be taken offline for more than 4 hours, (2) the security team has a budget of $100,000, and (3) the company's risk tolerance is low. The estimated cost of a data breach is $5 million. The security team has three options: (A) patch the vulnerability immediately, which requires 6 hours of downtime and costs $20,000; (B) deploy a WAF to mitigate the vulnerability, which requires 2 hours of downtime and costs $80,000; (C) accept the risk and monitor the application. Which option best balances the constraints and the company's risk tolerance?

   • AAccept the risk, because the cost of mitigation exceeds the budget.
   • BPatch the vulnerability immediately, because it eliminates the risk and the cost is within budget.
   • CPatch the vulnerability and deploy a WAF, because this provides the best protection.
   • DDeploy a WAF, because it reduces the risk within the downtime and budget constraints.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company's web server is running an outdated version of Apache that has a known remote code execution vulnerability. An attacker exploits this vulnerability to install a backdoor. In this scenario, what is the vulnerability?

   • AThe risk of a data breach
   • BThe outdated Apache version
   • CThe backdoor installed by the attacker
   • DThe attacker's exploit code
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A manufacturing company has a legacy industrial control system (ICS) that cannot be patched because it would disrupt production. A risk assessment shows that a cyberattack on the ICS could cause a plant shutdown. The company decides to implement network segmentation and monitoring to reduce the likelihood of an attack reaching the ICS. This is an example of which risk treatment strategy?

   • ARisk acceptance
   • BRisk mitigation
   • CRisk transfer
   • DRisk avoidance
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is conducting a risk assessment for its new cloud-based customer relationship management (CRM) system. The assessment team has identified the CRM as a critical asset, identified that a data breach could occur due to a misconfigured cloud storage bucket, and determined that the likelihood is medium and the impact is high. The company's risk appetite is low, meaning it cannot accept high-impact risks. Which risk treatment strategy should the company choose?

   • AMitigate the risk by implementing strict access controls and monitoring
   • BAvoid the risk by not using the cloud CRM system
   • CTransfer the risk by purchasing cyber insurance
   • DAccept the risk because the likelihood is medium
   Reveal Solution Discussion Select an answer first